#!/usr/bin/env bash
set -euo pipefail

node - <<'NODE'
const fs = require("node:fs");
const path = "agent/wordpress-mcp/server.example.json";
const manifest = JSON.parse(fs.readFileSync(path, "utf8"));
const expectedVariables = [
  "SITE_URL",
  "WP_REST_USER",
  "WP_REST_APPLICATION_PASSWORD",
];

if (manifest.manifestType !== "repository-access-documentation") {
  throw new Error("The MCP manifest type is not valid.");
}
if (manifest.enabled !== false) {
  throw new Error("The MCP manifest must remain disabled.");
}
if (manifest.client?.selected !== false || manifest.client?.name !== null) {
  throw new Error("The MCP manifest must not select a client.");
}
if (manifest.server?.selected !== false || manifest.server?.name !== null) {
  throw new Error("The MCP manifest must not select a server.");
}
if (manifest.transport !== "stdio") {
  throw new Error("The MCP manifest must specify stdio.");
}
if (JSON.stringify(manifest.requiredEnvironmentVariables) !== JSON.stringify(expectedVariables)) {
  throw new Error("The MCP manifest has incorrect environment variable names.");
}
if ("command" in manifest || "env" in manifest || "mcpServers" in manifest) {
  throw new Error("The MCP manifest must not contain executable client configuration.");
}
NODE

for command_path in scripts/wp-read.sh scripts/db-read.sh; do
  if [[ ! -x "$command_path" ]]; then
    printf 'Required command is missing or is not executable: %s\n' "$command_path" >&2
    exit 1
  fi
done

for ssh_option in \
  ClearAllForwardings=yes \
  ForwardAgent=no \
  PermitLocalCommand=no; do
  for ssh_path in scripts/wp-read.sh agent/ssh/README.md; do
    if ! grep -Fq -- "-o ${ssh_option}" "$ssh_path"; then
      printf 'Required SSH option is missing from %s: %s\n' \
        "$ssh_path" "$ssh_option" >&2
      exit 1
    fi
  done
done

if grep -q 'WP_REST_URL' \
  .env.example \
  agent/rest-api/README.md \
  docs/ACCESS.md \
  docs/superpowers/plans/2026-07-28-agent-wordpress-scaffold.md; then
  printf 'WP_REST_URL must not define the REST API target.\n' >&2
  exit 1
fi

for readme_path in \
  agent/rest-api/README.md \
  agent/wordpress-mcp/README.md \
  docs/ACCESS.md \
  scripts/rest-public-read.sh; do
  if grep -Eqi -- 'users/me|--basic|printf [^[:space:]]*user =' \
    "$readme_path"; then
    printf 'Authenticated WordPress verification is not allowed in %s.\n' \
      "$readme_path" >&2
    exit 1
  fi
done

for required_text in \
  "https://phyllisschlafly.com" \
  "https://www.phyllisschlafly.com" \
  "last_used" \
  "last_ip" \
  "cannot validate production application passwords"; do
  if ! grep -Fqi -- "$required_text" agent/rest-api/README.md; then
    printf 'Required public REST documentation is missing: %s\n' \
      "$required_text" >&2
    exit 1
  fi
done

for required_text in \
  "curl --disable --fail --silent --show-error" \
  "--proto '=https'" \
  "--proto-redir '=https'" \
  "--max-redirs 0" \
  "--no-location-trusted" \
  '${SITE_URL}/wp-json/'; do
  if ! grep -Fq -- "$required_text" scripts/rest-public-read.sh; then
    printf 'Required public REST safety control is missing: %s\n' \
      "$required_text" >&2
    exit 1
  fi
done

if ! grep -Fq 'Keep this access method disabled.' \
  agent/wordpress-mcp/README.md; then
  printf 'The MCP access method must remain disabled.\n' >&2
  exit 1
fi

printf 'Access template validation passed.\n'